---
typeId: req
recordId: benac-agt-004
fields:
  title: Agents cannot self-trust
  statement: Agents shall not be able to grant trust, capabilities, secret access,
    decryption authority, native execution, remote storage use, remote compute
    use, data egress permission, private key access, or disclosure authority to
    themselves unless separately authorized by local policy outside the
    requesting agent's authority.
  rationale: Agents can propose, build, test, and request authority. Benac records those
    requests and applies Local Policy so agent experimentation can proceed in small
    reviewable steps without invisible privilege escalation.
  verification: Agent-created trust request does not become active grant without approval.
  testable: true
  status: draft
  area: BENAC-AGT
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.14 Machine-readable client operation
  order: 156
---
